Qualys Cloud Platform

Free Services

@RISK Newsletter for January 18, 2018

The consensus security vulnerability alert.

Vol. 18, Num. 03

This is a weekly newsletter that provides in-depth analysis of the latest vulnerabilities with straightforward remediation advice. Qualys supplies a large part of the newly-discovered vulnerability content used in this newsletter.

CONTENTS:

NOTABLE RECENT SECURITY ISSUESINTERESTING NEWS FROM AROUND THE SECURITY COMMUNITYVULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLEMOST PREVALENT MALWARE FILES 2018-01-09 - 2018-01-16TOP VULNERABILITY THIS WEEK: Software and Firmware Updates Continue to Roll Out In Response to ‘Meltdown’ and ‘Spectre’

NOTABLE RECENT SECURITY ISSUESSELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Security Issue with Misconfigured Intel AMT-enabled Systems IdentifiedDescription: Researchers at F-Secure have identified a security issue with Intel-based system who have Active Management Technology (AMT) enabled. This issue manifests in misconfigured systems not correctly securing AMT and allowing an attacker to potentially gain control of the system. Intel has responded to the issue noting that organizations who utilize AMT should follow basic security guidelines they have laid out.Reference: https://business.f-secure.com/intel-amt-security-issue

Title: Two XSS Vulnerabilities in Ruby Rails Gems Identified and PatchedDescription: Researchers have identified two cross-site scripting vulnerabilities (XSS) vulnerabilities in Ruby Rails Gems. These two vulnerabilities manifest due to improper sanitization and handling of URLs. Software updates that address these vulnerabilities have been released.Reference: http://blog.talosintelligence.com/2018/01/vulnerability-spotlight-ruby-rails-gem.htmlSnort SID: 44380, 44381

RECENT VULNERABILITIES FOR WHICH EXPLOITS ARE AVAILABLECOMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2017-17562Title: EmbedThis GoAhead Remote Code Execution VulnerabilityVendor: EmbedThis GoAheadDescription: Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker, this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request, and reference it using /proc/self/fd/0.CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2017-8759Title: Microsoft .NET Framework Remote Code Execution VulnerabilityVendor: MicrosoftDescription: A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input. Microsoft is aware of a report that an exploit for CVE-2017-8759 exists in the wild and is being used in targeted attacks.Microsoft published a .NET security update to address this issue.CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2017-9805Title: Apache Struts REST plugin Remote Code Execution (S2-052)Vendor: Apache StrutsDescription: The REST Plugin is using a XStreamHandler with an instance of XStream for deserialization without any type filtering and this can lead to Remote Code Execution when deserializing XML payloads.CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2017-0290Title: Microsoft Malware Protection Engine Remote Code Execution VulnerabilityVendor: MicrosoftDescription: NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within any file scanned by this engine.CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID: CVE-2017-3881Title: Cisco IOS and IOS XE Software Cluster Management Protocol Remote Code Execution VulnerabilityVendor: CiscoDescription: A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. The Cluster Management Protocol utilizes Telnet internally as a signaling and command protocol between cluster members. The vulnerability is due to the combination of two factors: (1) the failure to restrict the use of CMP-specific Telnet options only to internal, local communications between cluster members and instead accept and process such options over any Telnet connection to an affected device; and (2) the incorrect processing of malformed CMP-specific Telnet options. An attacker could exploit this vulnerability by sending malformed CMP-specific Telnet options while establishing a Telnet session with an affected Cisco device configured to accept Telnet connections. An exploit could allow an attacker to execute arbitrary code and obtain full control of the device or cause a reload of the affected device. This affects Catalyst switches, Embedded Service 2020 switches, Enhanced Layer 2 EtherSwitch Service Module, Enhanced Layer 2/3 EtherSwitch Service Module, Gigabit Ethernet Switch Module (CGESM) for HP, IE Industrial Ethernet switches, ME 4924-10GE switch, RF Gateway 10, and SM-X Layer 2/3 EtherSwitch Service Module. Cisco Bug IDs: CSCvd48893.CVSS v2 Base Score: 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)